Someone short circuited?
Workplace hit by cryptolocker virus
- Thread starter Banzai_Joe
- Start date
Someone short circuited?
One of our users at work has been hit with Zepto last Wednesday.
The bad news is two-fold... firstly, the ~400GB of local data has all been encrypted, and secondly, their most recent backup of this was.... March.
It's great when everyone stores everything on the network, but when an average user has 400-2000GB of data, and 'demanding' users have orders of magnitude larger, local data really is their only option.
However, they know this, and a failure to maintain regular backups is their own fault.
Time to start teaching people the need for air-gapped backups methinks!
The bad news is two-fold... firstly, the ~400GB of local data has all been encrypted, and secondly, their most recent backup of this was.... March.
It's great when everyone stores everything on the network, but when an average user has 400-2000GB of data, and 'demanding' users have orders of magnitude larger, local data really is their only option.
However, they know this, and a failure to maintain regular backups is their own fault.
Time to start teaching people the need for air-gapped backups methinks!
Soldato
- Joined
- 20 Jul 2004
- Posts
- 3,653
- Location
- Dublin, Ireland
This thread has highlighted a ton of work for me get done. On our own server I've just realised how dodgy my backup situation is. Backups go to two NASs mapped to the server = Bad.
I think the best short term solution is to unmap the NAS Share and lock the share credentials to a unique Login used only by Veeam. Only Veeam will have access to the share.
Most of my Customers still use Tape for archiving, but use NASs for system restore snapshots. I'll have to do this for them too. A useful if scary thread.
Nate
I think the best short term solution is to unmap the NAS Share and lock the share credentials to a unique Login used only by Veeam. Only Veeam will have access to the share.
Most of my Customers still use Tape for archiving, but use NASs for system restore snapshots. I'll have to do this for them too. A useful if scary thread.
Nate
What you need is offline copies and a way to keep them isolated if you need to recover from them - i.e. mounting read only, taking a copy to work from, etc.
Soldato
- Joined
- 20 Jul 2004
- Posts
- 3,653
- Location
- Dublin, Ireland
Yep you're completely correct, In some cases I have Clients with Off-Site Cloud backup. Clients are in general reluctant to pay for that however. As for what I can do immediately, tomorrow, is limit access as much as possible, for the on-site infrastructure.
Longer term I'll need to rethink backups for those not using tape.
Nate
Longer term I'll need to rethink backups for those not using tape.
Nate
Man of Honour
- Joined
- 29 Mar 2003
- Posts
- 57,751
- Location
- Stoke on Trent
So how do I decide which PDF I can click on since I get at least 10 sent to me every day?
- Joined
- 30 Sep 2006
- Posts
- 5,286
- Location
- Midlands, UK
Lol, not rude mate, accurate! We have some of the dumbest ** Do not circumvent to swear filter - EVH ** that you can imagine.
I keep petitioning to lockdown the spam filters even further, but get met with concerns of important emails not getting through or business slowing down.
It's hard when the board of directors are like those adult babies off the haribo adverts......so they empathise with the low paid dufus that actually clicks to open an infected PDFs.
Can't flipping win.
Last edited by a moderator:
Soldato
- Joined
- 21 Oct 2011
- Posts
- 22,526
- Location
- ST4
Have your computer set to show extensions and don't click on the attachments that end in *.zip or *.exe
Only this wans't a .PDF.exe was it.
It was a malformed PDF, exploiting bugs in Adobe Reader to run code.
Got the same trouble. We're down to 250GB of storage so I've been using treesize to see where it's all gone (and as there's no more free slots in the server I can't even easily increase the storage). So I find that the manager of one of the offices has got a copy of every job he's done. And then within the same folder an "archive" of the same thing. So that's two copies. Except every job he's done is also (correctly) in the client folders so there's THREE copies of the same thing (plus the backups).
So that was 50GB recovered straight away. Except I suspect going by his comments he's just moved it to a local drive on his laptop. So if he's prepared to do that, wonder what else is on there.
Man of Honour
- Joined
- 29 Mar 2003
- Posts
- 57,751
- Location
- Stoke on Trent
Soldato
- Joined
- 20 Apr 2004
- Posts
- 4,423
- Location
- Rugby
Can you tell which machine it was introduced on and then slap that person around the face ?
How much do they want
Too many bitcoins.
Apparently she got a bit upset and nearly started to cry when she was told what she had done.
The email was basically a blank email, no subject, just an excel attachment with 'Sent from my iPhone' in the body from a completely random sender, opened the attachment and thought enabling the macros and running them would be a good idea.
With a haddock. Obligatory.
Too many bitcoins.
Apparently she got a bit upset and nearly started to cry when she was told what she had done.
The email was basically a blank email, no subject, just an excel attachment with 'Sent from my iPhone' in the body from a completely random sender, opened the attachment and thought enabling the macros and running them would be a good idea.
Women and technology simply don't mix.